CI/CD Security
CI/CD security is the practice of protecting the continuous integration and delivery pipeline and embedding automated security checks — such as SAST, dependency scanning, and secret detection — into it, so that both the pipeline and the code it ships stay secure.
CI/CD security has two complementary meanings. The first is securing the pipeline itself — the build servers, runners, credentials, and configuration — because a compromised pipeline can inject malicious code into every artifact it produces. The second is using the pipeline to enforce security: running automated scanners on every commit and pull request so vulnerabilities are caught before release.
On the enforcement side, teams add steps that perform static analysis, software composition analysis on dependencies, secret scanning, infrastructure-as-code checks, and container image scanning. These are typically tied to security gates that fail the build when findings exceed policy. On the protection side, best practices include least-privilege build credentials, pinned and verified dependencies, isolated runners, and signed, attested artifacts as described by frameworks like SLSA.
CI/CD security matters because the pipeline is both a high-value target and a powerful control point. Attackers increasingly target build systems to reach many downstream users at once, and at the same time the pipeline is the ideal place to enforce security automatically on every change without slowing developers down.